Lock MDM profile

Automated Device Enrollment (ADE, DEP in the portal) enables organizations to automatically enroll Apple devices in an MDM solution. The configuration profile associated with devices during ADE enrollment allows configurations to be deployed directly at startup. Continuous device management is only possible as long as the MDM profile remains installed on the devices. If users manually remove the MDM profile from devices, administrators can no longer manage those devices. Therefore, the MDM profile can be locked on the devices so that end users cannot remove it from the devices.

Configure profile for ADE #

Profiles for ADE are created in the portal under Devices → Profiles via Create. An existing profile is edited by opening it in the list.

The option User may remove MDM Enrollment is enabled by default in new profiles. To prevent the MDM profile from being removed, the option is disabled before the devices are enrolled. The remaining profile options are described under Profile for ADE →.

Set profile for ADE as default #

Use as default profile makes a profile the default profile. During synchronization with Apple Business Manager or Apple School Manager, Relution automatically assigns it to all newly transferred auto enrollments that do not yet have a profile assigned. A profile that is already assigned is not replaced.

Assign a profile for ADE afterwards #

Under Devices → Auto Enrollments, a profile can be assigned afterwards to the selected entries via Set profile. The assignment is transferred to Apple Business Manager or Apple School Manager and takes effect the next time the device is enrolled via ADE. Newly assigned devices appear in the list after the next synchronization, which can be triggered immediately via Sync devices.

When a profile is changed, Relution automatically reassigns the changed version to all auto enrollments that have this profile assigned.